Hi,
We can find file LCN number by calling function FSCTL_GET_RETRIEVAL_POINTERS with a handle to the file, but there are some files can't open because it has already been opend by system, such as pagefile.sys, I know there is a tool(nfi.exe) can do it( It also failed if you just specified pagefile.sys, but will success if you dump all file info on disk. ) Does anyone know how to do?
Thanks in advance!
Polo